eHealth, Recip-e, patient records: who can access what in your practice?

Two doors to your patients' data

In a practice, health data goes through two very different doors. The first opens onto shared data: the record that hospitals, doctors and pharmacists pool through the regional health networks, and the electronic prescriptions stored on Recip-e. The eHealth platform is the federal public body that links all of this together and checks who is knocking at the door.

The second door is your medical records software and the practice computers. Here, the state is no longer in control: you are. Who has an account, who sees clinical notes, who can open a patient's record from reception: it all depends on the settings you (or your IT provider) have made, or not made.

The first door is fairly well guarded. The second is often far less so. That is the one that deserves your attention.

What opens the door to shared data

For a healthcare provider to view a patient's shared data, several conditions must all be met at the same time. The eHealth platform (in French or Dutch) and the health networks apply these rules automatically.

• The patient's consent to the electronic sharing of their data. It is global: it applies to every healthcare provider who treats them. The patient manages it on MyHealth.
• A therapeutic relationship, meaning electronic proof that you are actually treating this patient. Reading their electronic identity card (eID) creates it for 15 months, renewed each time the card is read again.
• The right profession. An access grid sets what each profession can see. A doctor treating the patient has access to most of the shared data; other professions see only part of it, defined profession by profession.
• No exclusion. The patient can exclude a specific healthcare provider through MyHealth, and lift that exclusion later.

If the patient's card is not available, the doctor can type in the patient's national register number and card number by hand. The eHealth platform is clear on this: it must never be done without the patient's knowledge. That is the first thing to check at reception: nobody should be ‘creating links’ to save time.

The keys and their pitfalls

The eHealth certificate is worth a closer look. It is a file installed in your software, protected by a password, that lets the practice talk to eHealth services. It is valid for 36 months (in French) and its holder is responsible for how it is used. For an organisation, eHealth also requires its internal procedures to ensure that only authorised people can access the system.

Recip-e: who sees prescriptions?

Prescriptions for medicines are stored on the Recip-e server. The pharmacist finds them by scanning the barcode on the proof of prescription, or with the patient's eID card. Since 11 December 2023, a doctor can also view prescriptions written by other prescribers, again on the basis of a therapeutic relationship (NIHDI, in French).

The patient stays in control: in the NIHDI's MyHealth app (in French), they can hide a prescription from the pharmacist. They then collect it by showing the barcode themselves.

The real gap: inside the practice

Example, made up for illustration. A fictional group practice: three doctors, a secretary and a locum over the summer. In the morning, the first doctor to arrive opens their session on the reception PC, inserts their eID card and leaves it in the reader so the secretary can ‘get the records ready’. The account of the locum, who left in September, is still active. The eHealth certificate password is stuck under the screen.

None of this breaks any eHealth control: every connection is made in a doctor's name, with that doctor's therapeutic relationships. But in practice, anyone who walks behind the desk can read any patient's full record, and the log will say it was the doctor.

The Belgian Data Protection Authority (DPA) restated the principle in a 2023 decision (in French) about a hospital where all the medical staff could read a highly sensitive record: the only people authorised to access the data are those whose role or professional activities justify that access. The principle applies to a three-person practice just as it does to a hospital.

Real practices are no better prepared than the one in the example. In a survey published in June 2024 (in French) of 903 Belgian doctors and pharmacists, 19% said they had been victims of cybercrime in the previous ten years, and eight in ten had had no cyber security training in the previous five years.

Who should see what: an access grid for your practice

The right question is not ‘who has a password?’ but ‘what does each person need to do their job?’. Here is a starting grid, to adapt to your practice.

If your software cannot separate administrative from medical data, ask the vendor. It is a legitimate request, and the answer will tell you a lot about the tool.

Monday morning: seven practical steps

1. One person, one account. Every doctor, every locum and the secretary has their own login in the software. No more shared ‘practice’ session.
2. The doctor's eID card never stays in the reader when they leave the workstation, and nobody else knows their PIN.
3. Automatic screen locking after a few minutes of inactivity, especially at reception, where screens can be seen from the waiting room.
4. List the active accounts in the software and close those of people who have left. Do it again every time someone leaves.
5. Store the eHealth certificate password in a password manager, and put its expiry date (3 years) in the diary.
6. Check the secretary's access: they should see the diary and contact details, not clinical notes.
7. Ask your IT provider how they connect to your computers, who on their side has that access, and whether those connections are logged.

If a patient asks who opened their record

For shared data, they stay in control: they can exclude a healthcare provider through MyHealth. For your software, you are the one who must be able to answer. If everyone works under the same doctor's name, you won't be able to.

And if you find that an unauthorised person has viewed records, that is a data breach: it must be reported to the DPA (in French) without undue delay and, where possible, within 72 hours, unless it poses no risk to patients.

Check who can access your practice→